Add rate limiting on IP

[kennygrant]

Add rate limiting with IP as a filter. Possibly allow config of max tries per IP, and timeout between sets of tries, either in config file or in the code for the middleware (to avoid bloating the config with too many options).

[pankajagarwal]

Shouldn't this be handled at nginx or haproxy or LB level. one level above the real application. I mean this might be a thing you wouldn't want in a large deployment handling heavy traffic where the requests to the app server will come from load balancers.

[kennygrant]

It would definitely be optional, and in larger apps you're right it would be at a higher level, but might be useful in smaller apps to have this ability to avoid naive DOS attacks.

My end goal here is to have an application that is one binary and can be deployed anywhere with zero dependencies, but which you can scale out with a database/load balancer etc separately if required. So this isn't really a high priority item, just a note for later.